Reach tasks attached to topics, and read Etherpad pads

Testing against a local instance turned up four things the server was
getting wrong, all of them invisible against the live account because the
data that exposes them had never been produced there.

`GET /lessons/{id}/tasks` returns a bare array, not the `{data,total}`
envelope every sibling endpoint uses, so `.data` was undefined and a
topic's tasks silently vanished. Its items also carry no id at all —
`LessonLinkedTaskResponse` has no id property — which leaves a
topic-attached task unidentifiable: it is not a task element on the
course page, and once past due it is in neither task list. So its
submission, and its grade, could not be reached by any route. That is 18
of 60 tasks on the real account, now reachable: the ids come off the
legacy topic page, where each task is linked as `/homework/{id}`.

The types said `id: string` and `status: TaskStatus` on something that
has neither, which is what let this stay quiet; `LessonLinkedTask` and
`ResolvedTask` now say what is actually there.

Collaborative text editor elements come back with `content: {}`, and the
tool said their contents were unavailable. They are available: the
content-element endpoint returns the pad url *and* an Etherpad session
cookie, and the pad exports itself as text to whoever holds it. No API
key needed. Pads are now shown by get_board and indexed for search.

The store's file digest covered id and size on the grounds that file
records are immutable. `PATCH /file/rename/{id}` renames one in place,
so a rename was reported as nothing at all.

Finally, get_board reported an unpublished board as "no permission",
which sends the reader hunting for an access problem that is not there.

smoke gains checks for topic tasks and for pads, and no longer assumes a
populated index or a search term that happens to match. 39/39 live-only
and 41/41 index-backed, against both the live instance and a local one.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/smoke.mjs

@@ -106,30 +106,76 @@ const taskId = tasks.text.match(/\(`([0-9a-f]{24})`\)/)?.[1];
 check('list_tasks finished', !(await call('list_tasks', { scope: 'finished' })).isError);
 check('list_news', !(await call('list_news')).isError);
 
-// Walk courses until we find one with a board, to exercise the whole chain.
+// Walk courses collecting boards and lessons, to exercise the whole chain.
+// Every board id is collected rather than the first one taken: an unpublished
+// board is listed on the course page with its title but 403s when opened, so
+// "the first board in the course" is not reliably one that can be read.
 let boardId, fileId, lessonId, courseWithBoard;
+const boardIds = [];
+const topicsWithTasks = [];
 for (const id of courseIds) {
 	const course = await call('get_course', { courseId: id });
 	if (course.isError) continue;
 	courseWithBoard ??= id;
-	const b = course.text.match(/### Boards[\s\S]*?\(`([0-9a-f]{24})`\)/)?.[1];
-	const l = course.text.match(/### Topics[\s\S]*?\(`([0-9a-f]{24})`\)/)?.[1];
-	lessonId ??= l;
-	if (b && !boardId) boardId = b;
-	if (boardId && lessonId) break;
+	const boardsSection = course.text.match(/### Boards[\s\S]*?(?=\n### |$)/)?.[0] ?? '';
+	for (const m of boardsSection.matchAll(/\(`([0-9a-f]{24})`\)/g)) boardIds.push(m[1]);
+	lessonId ??= course.text.match(/### Topics[\s\S]*?\(`([0-9a-f]{24})`\)/)?.[1];
+	// A topic that reports tasks is the interesting one: those tasks are not task
+	// elements on the course page and carry no id in the API.
+	const topics = course.text.match(/### Topics[\s\S]*?(?=\n### |$)/)?.[0] ?? '';
+	for (const m of topics.matchAll(/\(`([0-9a-f]{24})`\) — (\d+) task/g)) topicsWithTasks.push(m[1]);
 }
 check('get_course', Boolean(courseWithBoard), `first usable course ${courseWithBoard}`);
-check('found a column board', Boolean(boardId), boardId);
+check('found a column board', boardIds.length > 0, `${boardIds.length} board(s)`);
 
-if (boardId) {
-	const board = await call('get_board', { boardId });
-	check('get_board', !board.isError && /Board id:/.test(board.text));
+let board, drafts = 0;
+for (const id of boardIds) {
+	const attempt = await call('get_board', { boardId: id });
+	if (!attempt.isError) {
+		board = attempt;
+		boardId = id;
+		break;
+	}
+	if (/draft/i.test(attempt.text)) drafts++;
+}
+if (boardIds.length > 0) {
+	check(
+		'get_board',
+		Boolean(board) && /Board id:/.test(board.text),
+		boardId ? `opened ${boardId}${drafts ? `, skipped ${drafts} unpublished` : ''}` : 'no board could be opened',
+	);
+}
+if (board) {
+	// Pads carry real content and the board API returns them empty, so the text
+	// comes from Etherpad itself. Either it was read, or the tool says plainly
+	// that it was not — it must never claim the contents cannot be had.
+	const padLine = board.text.match(/- Collaborative text document `[0-9a-f]{24}`[^\n]*/)?.[0];
+	check(
+		'collaborative text documents report contents or say they are empty',
+		padLine === undefined || /:$|\(empty, or its contents could not be read\)/.test(padLine),
+		padLine ?? 'no pad on this board',
+	);
 	fileId = board.text.match(/File: \*\*[^*]+\*\* \(`([0-9a-f]{24})`/)?.[1];
 	check('get_board resolved attachments', Boolean(fileId), fileId ?? 'no files on this board');
 	check('get_board includeFiles=false', !(await call('get_board', { boardId, includeFiles: false })).isError);
 }
 
 if (lessonId) check('get_lesson', !(await call('get_lesson', { lessonId })).isError, lessonId);
+
+// A task attached to a topic is reachable only if its id was recovered from the
+// topic page: the API's topic-task projection has no id field, and such a task
+// is on no course page and drops out of both task lists once it is past due.
+if (topicsWithTasks.length > 0) {
+	const lesson = await call('get_lesson', { lessonId: topicsWithTasks[0] });
+	const topicTaskId = lesson.text.match(/### Tasks in this lesson[\s\S]*?\(`([0-9a-f]{24})`\)/)?.[1];
+	check('get_lesson lists a topic\'s tasks with ids', Boolean(topicTaskId), topicTaskId ?? lesson.text.slice(0, 90));
+	if (topicTaskId) {
+		const viaTopic = await call('get_task', { taskId: topicTaskId });
+		check('get_task opens a task found only through a topic', !viaTopic.isError && /Task id:/.test(viaTopic.text));
+	}
+} else {
+	check('get_lesson lists a topic\'s tasks with ids', true, 'no topic on this account reports tasks — nothing to check');
+}
 if (taskId) {
 	const task = await call('get_task', { taskId });
 	check('get_task', !task.isError && /Task id:/.test(task.text), taskId);
@@ -180,13 +226,25 @@ check(
 	hasIndex ? !status.isError : status.isError && /not configured/.test(status.text),
 	status.text.split('\n')[0],
 );
-const changed = await call('what_changed', { since: '2026-01-01' });
-check('what_changed responds', hasIndex ? !changed.isError : changed.isError);
 if (hasIndex) {
+	// Populate before asking what changed: a brand-new index holds no generations
+	// to diff, and what_changed rightly refuses rather than inventing a baseline.
 	const refreshed = await call('refresh_index', { courseId: courseIds[0], force: true });
 	check('refresh_index re-crawls one course', !refreshed.isError, refreshed.text.split('\n')[0]);
+}
+const changed = await call('what_changed', { since: '2026-01-01' });
+check('what_changed responds', hasIndex ? !changed.isError : changed.isError, changed.text.split('\n')[0]);
+if (hasIndex) {
+	// Both the hit and the no-hit answer say when the index was last refreshed;
+	// a live crawl (fresh=true) says nothing of the sort. That is what separates
+	// "answered from the index" from "answered by crawling", whatever the term
+	// happens to match in this account's data.
 	const indexed = await call('search', { query: searchTerm });
-	check('search uses the index and states freshness', !indexed.isError && /Index /.test(indexed.text));
+	check(
+		'search uses the index and states freshness',
+		!indexed.isError && /refreshed/i.test(indexed.text),
+		indexed.text.split('\n')[0],
+	);
 }
 
 console.log('\n== api_get guard rails ==');